trivysupplychainanalysis

多阶段CI/CD供应链攻击的定量分析 一个经过形式化验证、定量重建 的2026年3月Trivy / "TeamPCP" GitHub Actions供应链入侵事件（CVE-2026-33634 ）——在TLA+中建模，由TLC穷举检查，并通过PRISM概率模型检验器量化。 论文中的每一个数字都从这个仓库重新生成。 模型、概率、语料库测量和校准结果均可从源码通过每层一个命令重现。 事件经过与本研究证明的内容 攻击者能够移动一个广泛使用的Action（trivy-action /...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

Embedded Malicious Code

Overview @emilgroup/docxtemplater-util is an A new version of the package Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released ...

Embedded Malicious Code

Overview @emilgroup/insurance-sdk is an A new version of the package Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NP...